stdlib has 17 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 5 in the last 90 days against 3 in the 90 before. The busiest recent month was August 2026 with 5. The median CVSS is 7.5 (high). None have a confirmed exploitation report.

CVEs per month

Weakness classes

Products

Worst active — by depth score

stdlib vulnerabilities

Avoid quadratic complexity in resolvePath in net/url

Fix Javascript regexp context tracking in html/template

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Add recursion depth guard during decode in encoding/xml

Enforce maximum recursion depth in encoding/asn1

Quadratic complexity in WordDecoder.DecodeHeader in mime

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Inefficient policy validation in crypto/x509

Unexpected session resumption in crypto/tls

Excessive CPU consumption when building archive index in archive/zip

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

Unbounded allocation when parsing GNU sparse map in archive/tar

Stack exhaustion in Parse in go/build/constraint

Memory exhaustion when compiling regular expressions in regexp/syntax

Incorrect sanitization of forwarded query parameters in net/http/httputil

Unbounded memory consumption when reading headers in archive/tar

Failure to strip relative path components in net/url